On 9/5/23 11:03, Boris Brezillon wrote:
>> * But
>> + * acquiring the obj lock in
>> drm_gem_shmem_release_pages_locked() can
>> + * cause a locking order inversion between
>> reservation_ww_class_mutex
>> + * and fs_reclaim.
>> + *
>> + * This deadlock is not actually possible, because no one should
>> + * be already holding the lock when drm_gem_shmem_free() is
>> called.
>> + * Unfortunately lockdep is not aware of this detail. So when
>> the
>> + * refcount drops to zero, don't touch the reservation lock.
>> + */
>> + if (shmem->got_pages_sgt &&
>> + refcount_dec_and_test(&shmem->pages_use_count)) {
>> + drm_gem_shmem_do_release_pages_locked(shmem);
>> + shmem->got_pages_sgt = false;
>> }
> Leaking memory is the right thing to do if pages_use_count > 1 (it's
> better to leak than having someone access memory it no longer owns), but
> I think it's worth mentioning in the above comment.
It's unlikely that it will be only a leak without a following up
use-after-free. Neither is acceptable.
The drm_gem_shmem_free() could be changed such that kernel won't blow up
on a refcnt bug, but that's not worthwhile doing because drivers
shouldn't have silly bugs.
--
Best regards,
Dmitry
